MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fcb1a9a015a830b45901658af220b5c14aafa9f17e74ba162482942ec49fe635. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SnakeKeylogger

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	fcb1a9a015a830b45901658af220b5c14aafa9f17e74ba162482942ec49fe635
SHA3-384 hash:	ae8687c78c8618f04447b5089c87073b7d96d0e1e28f59f081fc0fc514298cc5d78b36ed102a3cf63cb5a7cc332539ab
SHA1 hash:	dc0032b4f82bc884a7f428f93ea8fe8452772402
MD5 hash:	1ac1be0e7e1a945a547a3c19e3f9f2c9
humanhash:	louisiana-bakerloo-bulldog-mountain
File name:	Shipping Documents.rar
Download:	download sample
Signature	SnakeKeylogger Create hunting rule
File size:	222'153 bytes
First seen:	2023-03-08 09:31:55 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:/TFaoPISXKQF/lgvyDTUlCqbf077u0xLB8SispK2x1S:/TsoPjbF/lgvcTUlTbfqu0lzS
TLSH	T1772412F5E4723A12F4751B3EC6F208922BE460133E5E646D6F1D3AB246C846E68D84F9
TrID	58.3% (.RAR) RAR compressed archive (v-4.x) (7000/1) 41.6% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	rar Shipping SnakeKeylogger

cocaman

Malicious email (T1566.001)
From: "Ahmed Hatata <a.hatata@expoeg.com>" (likely spoofed)
Received: "from expoeg.com (unknown [212.193.30.60]) "
Date: "8 Mar 2023 06:29:11 +0100"
Subject: "Re: **TOP URGENT** Shipping Documents"
Attachment: "Shipping Documents.rar"

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Shipping Documents.exe
File size:	237'718 bytes
SHA256 hash:	cd8f48ff53a64677eead33cd179d5215e63e59d5e5bcd9cdddf2c3876f638027
MD5 hash:	0990e6f19a7730450834c60104b5d7fe
MIME type:	application/x-dosexec
Signature	SnakeKeylogger

Vendor Threat Intelligence

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/fcb1a9a015a830b45901658af220b5c14aafa9f17e74ba162482942ec49fe635/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

nemesis overlay packed shell32.dll snakekeylogger

Link:

https://www.filescan.io/uploads/64085613e96aa01651237510/reports/441d359f-5425-4553-965c-2f0b1f49045d/overview

Verdict:

Malicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/fcb1a9a015a830b45901658af220b5c14aafa9f17e74ba162482942ec49fe635

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fcb1a9a015a830b45901658af220b5c14aafa9f17e74ba162482942ec49fe635/

Threat name:

Win32.Trojan.SnakeKeylogger

Status:

Malicious

First seen:

2023-03-08 02:37:03 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7sy2tiavvayliwibmwfpeifvyffk7kprpz2lufreqkkc5re74y2q._file

Result

Malware family:

snakekeylogger

Score:

10/10

Tags:

family:snakekeylogger collection keylogger persistence spyware stealer

Link:

https://tria.ge/reports/230308-lrmsgsef8v/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Adds Run key to start application

Looks up external IP address via web service

Executes dropped EXE

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Snake Keylogger

Snake Keylogger payload

Malware Config

C2 Extraction:

https://api.telegram.org/bot6284958682:AAFqhG3qHKFjAq48ezySmL8vRDzlw2Jx9s8/sendMessage?chat_id=5636036075

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/fcb1a9a015a830b45901658af220b5c14aafa9f17e74ba162482942ec49fe635

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.